LimeSurvey

limesurvey.org · 15 vendors

Resilience scores

Technology vendors

Insights

Last updated 2026-08-20 · revision 2

15 direct vendors, 247 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

LimeSurvey's migration readiness is moderate, facing both opportunities and significant challenges. The core internal tech stack, based on PHP, MySQL/MariaDB/PostgreSQL/MSSQL, and Apache/nginx, represents a more traditional architecture. While they use modern frontend tools like React and Node.js, and employ CI/CD with GitHub Actions, there is no explicit mention of cloud-native architectures like containerization (e.g., Docker, Kubernetes) or microservices, which suggests a potentially monolithic structure that could require significant refactoring for a full cloud-native migration. The existence of a LimeSurvey Cloud (SaaS) offering indicates experience operating in a cloud environment, which is a positive for migration. However, critical data gaps pose substantial risks: there is no information on financial stability, making it impossible to assess the company's ability to fund a potentially costly and extensive migration. Furthermore, 'Data Residency Requirements' are not specified, which could introduce complex and expensive compliance hurdles if strict requirements emerge during migration planning. Similar to resilience, the contradictory 'Total Vendors: 0' alongside 'Total Services: 20' and vendor geographic diversity makes assessing vendor lock-in complex. The 'Vendor Lock-in Risk: Unknown' is a significant challenge, as dependencies on 20 services without clear lock-in status could complicate migration efforts. On the positive side, explicit GDPR compliance and WCAG accessibility mean these regulatory requirements are understood, simplifying the compliance aspects of migration. Overall, the mixed tech stack and significant unknowns regarding financials, data residency, and vendor lock-in place LimeSurvey in the medium readiness category.

Compliance

6 in-scope frameworks identified; showing 3.

BDSG — Partially Compliant

As a German GmbH headquartered in Hamburg, LimeSurvey is subject to the German Federal Data Protection Act (BDSG), which supplements and specifies GDPR requirements under German law. The BDSG includes additional requirements for employee data processing, data protection officers (mandatory for companies with 20+ persons regularly processing personal data using automated means), and specific rules for processing sensitive data. LimeSurvey has appointed a DPO (Martin Bastius via heydata.eu), which satisfies the BDSG DPO requirement. The company is registered in the Hamburg commercial register (HRB 137625). Risk is Medium because while the DPO appointment and GDPR-aligned privacy notice address core BDSG requirements, the absence of ISO 27001 certification and any BDSG-specific audit leaves residual uncertainty about full compliance with all BDSG supplementary requirements.

Evidence: https://www.limesurvey.org/privacy-notice, https://www.limesurvey.org/legal-notice

GDPR (source) — Partially Compliant

LimeSurvey GmbH is headquartered in Hamburg, Germany — a core EU member state — making GDPR universally and unambiguously applicable. The company has appointed a named Data Protection Officer (DPO), publishes a detailed GDPR-aligned privacy notice citing specific GDPR articles (Art. 6, 15–21, 28), uses EU-based web hosting (Hetzner Online GmbH, Germany), and has concluded Art. 28 Data Processing Agreements with sub-processors. These are strong indicators of active GDPR compliance efforts. However, the company also transfers data to third-country processors (Zoho India) relying on Standard Contractual Clauses (SCCs), and ISO 27001 certification — a key technical safeguard often expected by regulators — is still 'in progress.' No public record of a GDPR audit, supervisory authority inspection, or formal compliance certification was found. Risk is Medium rather than High because the company demonstrates clear awareness and structural compliance measures, but the absence of a completed ISO 27001 certification and any third-party GDPR audit leaves residual uncertainty about the completeness of technical and organisational measures (TOMs).

Evidence: https://www.limesurvey.org/privacy-notice, https://www.limesurvey.org/legal-notice, https://www.limesurvey.org/, https://www.limesurvey.org/sovereignty/privacy

SOC 2 (source) — Assessment Required

LimeSurvey is a cloud-based SaaS platform serving 60,000+ organisations globally, including enterprise, public sector, and healthcare customers. SOC2 (Type I or Type II) is a widely expected assurance standard for cloud service providers, particularly when serving enterprise and regulated-sector customers. No SOC2 report or certification was found on LimeSurvey's public website, and it is not mentioned in any official documentation. The absence of SOC2 is a notable gap for a SaaS provider of this scale, as enterprise procurement teams and regulated-sector customers (government, healthcare, finance) typically require SOC2 Type II reports as part of vendor due diligence. Risk is Medium because while SOC2 is not legally mandated, its absence may create commercial risk and procurement barriers with enterprise customers, and it signals a potential gap in independently verified security controls.

Evidence: https://www.limesurvey.org/, https://www.limesurvey.org/privacy-notice

Financials

Three-year financials

Financial Resilience Score: 6/10

LimeSurvey GmbH is an established Hamburg-based open-source survey software vendor with a strong brand and long track record dating back to 2003 (as PHPSurveyor). The company benefits from a diversified customer base spanning 60,000+ organizations across 160+ countries, with notable blue-chip and public-sector references including BMW Group, GNOME, Ubuntu, and various universities and government statistical offices. Its freemium/open-source model provides low customer-acquisition costs, and its EU-hosted, GDPR-native positioning offers meaningful differentiation versus US hyperscaler-based competitors like Qualtrics and SurveyMonkey, particularly appealing to DACH public sector and academic buyers. However, financial resilience cannot be fully assessed because as a small German GmbH, LimeSurvey files only abbreviated balance sheets in the Bundesanzeiger and is exempt from disclosing revenue, EBIT, or a full P&L. This limited transparency is itself a governance/counterparty risk. The company faces scale disadvantages relative to global survey-SaaS peers with far larger R&D budgets, key-person concentration risk with a single managing director (Jory Nagel), and reliance on price-sensitive academic/public-sector customers. The company appears self-funded with no known VC backing, which suggests conservative financial management but limits capacity for aggressive growth investment. A moderate resilience score reflects the established brand and sticky customer base offset by scale limitations and opacity of financials.

Key strengths: Established brand with 20+ year track record dating to 2003, 60,000+ organizations across 160+ countries as customers, Blue-chip and public-sector references (BMW, Ubuntu, government statistics offices), GDPR-native / EU digital sovereignty positioning, Freemium/open-source funnel reduces customer acquisition costs, Multi-region hosting including USA expands addressable market, Lean cost base typical of small Hamburg GmbH, Appears self-funded/founder-operated with no known VC dependency

Risk factors: Intense competition from Qualtrics, SurveyMonkey, Google Forms, Microsoft Forms, Typeform, Alchemer, Scale disadvantage limiting R&D and AI investment capacity, Heavy concentration in price-sensitive academic and public-sector customers, Open-source cannibalization risk from self-hosted Community Edition, Limited financial transparency due to small-GmbH status, Key-person concentration with single managing director, FX exposure on USD hosting costs vs EUR revenue, AI features still in beta while competitors advance rapidly

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report